Zcash did not come from one person. It came from a research paper with 7 named authors, published at an academic conference two years before any coin existed. The code that shipped was then written by a different, smaller group.
That is why this question has no Satoshi-shaped answer. There is no pseudonym here, and no mystery either. There is a citation, a conference, plus a list of names you can look up. Bitcoin's own origin works the other way round, and our guide to who created Bitcoin covers that contrast.
what follows covers where Zcash came from and what the founders' reward was. Our guide to Zcash dev fund covers the funding arrangement that replaced it.
The research came first, and it has a citation
The paper is called "Zerocash: Decentralized Anonymous Payments from Bitcoin". It was presented at the 2014 IEEE Symposium on Security and Privacy. That conference is one of the field's main venues, and its program from that year still carries the paper's abstract (source: IEEE Symposium on Security and Privacy).
Seven people wrote it. Eli Ben-Sasson at the Technion, Alessandro Chiesa at UC Berkeley, Christina Garman, Matthew Green and Ian Miers at Johns Hopkins, Eran Tromer at Tel Aviv University, and Madars Virza at MIT (source: Zerocash project). Five institutions and one paper.
It was not the first attempt. The abstract says the work "builds on the previous Zerocoin work of Miers et al", an earlier design by some of the same people. The Zerocash team describe the difference plainly on their own site: Zerocoin hid a payment's origin but not its destination or its amount.
So the jump from Zerocoin to Zerocash was the jump from hiding half a payment to hiding all of it. That distinction is still the one that matters most when people ask what Zcash actually conceals, and our crypto privacy basics guide covers the general version of it.
The paper also lists who funded the work, as academic papers do. The list names universities and foundations. It also names a US defense research agency, a naval research office, and a government science ministry.
That is worth stating flatly, without a raised eyebrow. Academic cryptography is funded this way all the time. The acknowledgements were published openly, and the paper carries the standard line that the views are the authors' own.
What the paper got right, and what shipping it required fixing
A paper is a design. Turning a design into a network that holds real money is a separate job, and a much larger one. The current protocol specification is unusually direct about how much of that job there was, which is rare in a document of its kind.
Its abstract describes Zcash as "an implementation of the Decentralized Anonymous Payment scheme Zerocash, with security fixes and improvements to performance and functionality" (source: Zcash protocol specification). The phrase "security fixes" is doing real work in that sentence.
The specification devotes a whole numbered section to differences from the paper. Two of its subsections are named after attacks the implementers found and closed before launch: the "Faerie Gold attack and fix" and the "Internal hash collision attack and fix".
Those are flaws in a peer-reviewed design rather than typos or performance tweaks. The people building the software found them, and the shipping specification documents them under their own headings.
This is the part of the origin story that usually gets skipped. The research was excellent. It was also not finished, and the gap between a paper at a conference and software holding real value is where a second group of people did their work.
It is also why the founding question has two halves. Ask who designed the privacy scheme and you get one list of names. Ask who made it safe to run and you get another. Both lists are public. Neither is a secret, and neither is a single person.
The company, the code, then the date
The implementation was built by a company set up to do exactly that, and that company is now called the Electric Coin Company. The current protocol specification names four authors on its cover: Daira-Emma Hopwood, Sean Bowe, Taylor Hornby and Nathan Wilcox.
Compare that with the seven names on the paper. Only one person appears on both lists in the documents used here. The people who designed the protocol and the people who wrote the protocol are largely different sets, which is the single most useful thing to know about this question.
The network launched on October 28, 2016. Two independent sources agree. The repository's v1.0.0 release is tagged that day (source: zcash/zcash), and a company post three weeks later opens by referring to "the Zcash launch of October 28th, 2016" (source: Electric Coin Company).
Two sources for a date may look like overkill. It is not. That matters on a subject where most secondary accounts copy each other, and the two here are of different kinds: one is a machine-recorded tag and one is a human writing at the time.
Zcash launched as a proof-of-work chain, like Bitcoin, and inherited a good deal of Bitcoin's structure along with it. Our explainer on proof of work covers the shared mining mechanism. How UTXOs work covers the accounting model both chains use on their transparent side.
One thing it did not inherit was Bitcoin's supply story. The cap is the same number and the reasoning behind it is not, which Bitcoin's 21 million supply sets out on the Bitcoin side and our guide to Zcash tokenomics takes on for Zcash.
The founders' reward, stated as history
For roughly the first four years, a fixed share of every block went to the project's founders rather than to the miner who found it. This was written into the consensus rules from the first block. It was not arranged privately afterwards, and it was not optional for anyone running a node.
The specification defines it precisely. The founders' reward "is paid by a transparent output in the coinbase transaction, to one of NumFounderAddresses transparent addresses, depending on the block height". That constant is set out a few pages earlier: NumFounderAddresses N:= 48.
The size was one fifth. The specification carries it as a constant named FoundersFraction, set to 1/5, so 20% of each block subsidy went to the founders' reward and 80% to the miner. That 20% is the historical figure and it no longer applies, so treat any current subsidy question as our guide to Zcash tokenomics's rather than this one's.
The company began moving those funds a month after launch. Its November 2016 post says transfers would start "sometime on or after November 28th, 2016", and that recipients could use the funds as they saw fit.
The arrangement was written to end, and it did. The specification states the change in two lines. Before the Canopy upgrade the block subsidy was "a miner subsidy and a Founders' Reward"; from Canopy onward it is "a miner subsidy and a series of funding streams". Canopy was Network Upgrade 4, deployed under a specification created in February 2020 (source: ZIP 251).
Here is the detail worth carrying away. All 48 founder addresses are still printed in the current specification, six years after the last payment. They have to be, because any node checking the chain from its first block must verify those old blocks paid what the rules of the day required. The history is still being executed every time someone syncs from genesis.
The founders' reward is argued about. this is not going to settle it. What the documents show is a fixed share paid to a fixed list of addresses, with a fixed end point and no discretion anywhere in it.
What a founding story leaves out
It does not tell you who controls Zcash now. A founding company is not an owner. Changes go through a public proposal process instead, and the current specification is itself a living document with a version number and a date on it (source: Zcash protocol specification). Our guide to what Zcash is covers who builds and decides today.
It does not tell you where the money goes now. The founders' reward ended at Canopy. A different arrangement replaced it, with different recipients and its own documents. Our guide to Zcash dev fund covers that one, and our guide to Zcash tokenomics covers the current subsidy split.
It does not tell you whether the design is sound. That question is answered by the specification, by six years of published upgrades, then by the attacks found since, not by who wrote the first draft. Reading the halving explainer will tell you more about how the issuance actually behaves than any founder's name will.
It does not tell you that the sources will still be there. The Zerocash project site is live and still links to the earlier Zerocoin paper at its original domain. That domain now serves gambling spam. Checked directly: the page contains the word "zerocoin" zero times. A ten-year-old origin story is partly held together by links that no longer lead where they say.
And it does not tell you anything about holding the asset. Whoever wrote the paper, your coins are yours to secure. That is what our guide to holding your own keys is for, and none of it depends on who founded anything.
The sequence, in order
Five stages, and the gaps between them are the part most accounts compress.
The research came first. A construction for private payments on a public ledger was described, reviewed and published in the academic literature, several years before any network existed. That work is citable, and it is the reason claims about the design can be checked against something other than a company's own material.
Then came the engineering gap. Publishing a construction is one thing. Making it run is another. A great deal of what shipped differs from the paper, because the paper's version was too slow or too large to be practical. That gap is normal in cryptography and it is routinely omitted from founding stories.
Then came the company and the launch. An organization was formed to build and ship the implementation, and the network started producing blocks in 2016 under a funding arrangement written into the protocol itself.
Then came the argument about that arrangement. Because the funding was in the consensus rules rather than in a private agreement. Changing it required a public process, and that process has run more than once. Our page on the development fund covers where it stands.
Then came the dispersal. Development today is spread across several independent organizations rather than concentrated in one, which is a materially different arrangement from the one at launch and the one people usually have in mind.
Reading those five as a single event is what produces most of the confident wrong statements about who runs Zcash.
Why the founding arrangement stayed contentious
Three features of the original design keep the argument alive, and none of them is about anybody's conduct.
It was written into the rules. A funding arrangement in a private agreement expires or gets renegotiated quietly. One in the consensus rules has to be changed by a process everyone can watch, which guarantees a public argument every time it comes up.
It was time-limited, which meant a decision point arrived on a known schedule. A deadline forces a conversation whether or not anyone is ready for it.
And it distributed value to a set of recipients that has changed over time. Each change re-opens the question of who should receive what, and each answer creates a constituency for the next round.
The result is a project that argues about its own economics in public on a recurring basis. That is genuinely unusual. It is a direct consequence of decisions made before launch, and it is why the founding story is still load-bearing rather than decorative.
Why the origin still shapes the project
A founding story is usually trivia. Here three specific things about the origin still determine how the network behaves, which is why the history is worth more than the anecdote.
It began as published research rather than as a product. The construction was described in an academic paper, reviewed and then cited before any coin existed. That order still shows in how the project works today: changes are specified in writing, argued in public, then implemented afterwards rather than the other way around.
It required a cryptographic setup that had to be trusted at the time. That single design decision generated more scrutiny than everything else about the launch combined, drove years of engineering to remove the requirement, and remains the most common thing people know about the project. Our page on the trusted setup covers what it was and what replaced it.
And it launched with a funding arrangement written into the protocol rather than raised from investors. That produced a continuing public argument about who receives what, which is unusual: on most chains that question was settled privately before launch and is not open to anyone.
Put those three together and you have a project that moves slowly, documents heavily, and argues about its own economics in public. Whether that is a strength depends on what you want from it, and it is at least predictable.
Limits of a founding story
Four things, and each of them is a question people reach for the origin to answer.
It does not tell you who controls the network now. Development is spread across several independent organizations and consensus changes go through a public proposal process, which is a very different arrangement from the one at launch. Our guide to how Zcash governance works covers the current shape.
It does not tell you whether the cryptography is sound. That question is settled by review and by the defect record, not by the credentials of the people who started it.
Nor does it tell you whether the funding arrangement is fair. That is a live disagreement between informed people, and an origin story establishes only how the arrangement came to exist.
And it does not tell you anything about the asset as a holding. Founding quality and market behavior are unrelated, and the years since launch have demonstrated that in both directions.
Who runs Zcash today
The short answer is that no single organization does, and the longer answer is worth having because the question comes up constantly.
Several independent organizations build software. They publish separately, they disagree in public, and none of them can change the rules on its own.
Consensus changes go through a written proposal process that anyone can read. A change needs a specification, an implementation and an activation height, and all three are public before anything happens.
Node operators decide what runs. Software that does not adopt a change stops following the same chain, so the people running nodes are the last step in every change whether or not they think of themselves that way.
And holders decide almost nothing about the rules. There is no vote on consensus changes. Where holder signalling has been used, it has informed funding decisions rather than protocol ones.
Frequently asked questions
Who founded Zcash?
There is no single founder. The underlying research was published in 2014 by seven authors across five institutions, and the implementation was built by a company now called the Electric Coin Company. The current protocol specification names four authors, only one of whom appears on the original research paper. Naming one person as the creator of Zcash is not supported by either document.
Is Zcash based on Bitcoin?
Partly. Zcash uses Bitcoin's transaction structure and proof-of-work mining on its transparent side, and the research paper's own title describes the design as anonymous payments "from Bitcoin". The private side is entirely different and comes from the Zerocash paper, which was published two years before Zcash existed. The protocol specification also documents where the implementation departs from that paper, so the lineage is two steps rather than one. Our guide to Zcash vs bitcoin covers where the two chains diverge in practice.
What was the Zcash founders' reward?
A fixed share of each block that went to the project's founders instead of the miner, written into the consensus rules from launch. The protocol specification sets the share as a constant equal to one fifth, paid to one of 48 transparent addresses depending on block height. It ran for roughly four years and ended at the Canopy network upgrade, which replaced it with a different funding arrangement.
Does the founders' reward still exist?
No. It ended at the Canopy network upgrade, and the specification now describes the block subsidy as a miner subsidy plus funding streams rather than a miner subsidy plus a founders' reward. The 48 addresses remain printed in the current specification anyway. Any node validating the chain from its first block still has to check that historical blocks paid them correctly, so the old rule is retired without being deleted.
Researched and written by the BloFin Academy editorial team with AI-assisted drafting. Primary sources are the Zcash protocol specification, the Zerocash project's own site, the 2014 IEEE Symposium on Security and Privacy program, the project repository's release history, and a dated first-party company post. All facts independently verified against cited documentation current as of August 2026. what follows states the founding arrangement as history and does not defend or attack it.